Securing Nfs - Red Hat LINUX 7.2 Reference Manual

Section 17.4:Securing NFS
17.3.3 Common NFS Mount Options
Beyond mounting a filesystem via NFS on a remote host, a number of different options may be speci-
fied at the time of the mount that can make it easier to use. These options can be utilized with manual
mount commands, /etc/fstab settings, and autofs, and other mounting methods.
The following options are the most popular for NFS mounts:
• hard or soft specifies whether the program using a file via an NFS connection should stop
and wait (hard) for the server to come back online if the host serving the exported filesystem is
unavailable, or if it should report an error (soft).
If you specify hard, you will not be able to terminate the process waiting for the NFS communi-
cation to resume unless you also specify the intr option.
If you specify soft, you can set an additional timeo= <value> option, where <value> spec-
ifies the number of seconds to pass before the error is reported.
• intr allows NFS requests to be interrupted if the server goes down or cannot be reached.
• nolock is occasionally required when connecting to older NFS server. To require locking, use
the lock option.
• noexec does not permit the execution of binaries on the mounted filesystem. This is useful if
your Red Hat Linux system is mounting a non-Linux filesystem via NFS that contains binaries
that will not execute on your machine.
• nosuid does not allow set-user-identifier or set-group-identifier bits to take effect.
• rsize=8192 and wsize=8192 may speed up NFS communication for reads (rsize) and
writes (wsize) by setting a larger data block size, in bytes, to be transferred at one time. Be
careful when changing these values; some older Linux kernels and network cards may not work
well with larger block sizes.
• nfsvers=2 or nfsvers=3 specify which version of the NFS protocol to use.
Many more options are available on the mount man page, including options to be used when mounting
non-NFS filesystems.

17.4 Securing NFS

NFS works well for sharing entire filesystems with a large number of known hosts in a largely trans-
parent manner. Many users accessing files over an NFS mount may not be aware that the filesystem
they are using is not local to their system. However, with ease of use comes a variety of potential
security problems.
293